Thalix Health

Clinical safety and assurance

What does a clinical safety officer do?

Short answer

A clinical safety officer (CSO) is the person responsible for making sure a health IT system is safe through clinical risk management. Under DCB0129 and DCB0160 they must be a suitably qualified, experienced and currently registered clinician who knows risk management, and they approve the clinical risk management plan, every version of the hazard log and every clinical safety case report.

Sources checked October 2026 · General information, not legal, regulatory or clinical safety advice

What the standards require of the person

Both specifications set the same four requirements (section 2.3):

  • A suitably qualified and experienced clinician.
  • Holding a current registration with an appropriate professional body for their training and experience.
  • Knowledgeable in risk management and its application to clinical domains.
  • Making sure the processes defined by the clinical risk management process are followed.

DCB0129's glossary notes the role was previously called the "Responsible Person". Top management must nominate the CSO, and also define in the risk management plan who can authorise the system and its safety documents.

What the clinical safety officer signs

  • The clinical risk management plan, including the risk acceptability criteria.
  • Each version of the hazard log; an issued hazard log goes with every safety case report.
  • Each clinical safety case report. A manufacturer produces one at each lifecycle phase in its plan; a deploying organisation produces one for deployment, use, maintenance and decommissioning.

A manufacturer and a hospital each need their own CSO. The supplier's CSO signs off the product's DCB0129 work; the hospital's CSO signs off the DCB0160 work for how the product is used locally.

Where the CSO appears elsewhere

In a DTAC assessment, section C1 (clinical safety) lists the clinical safety officer or engineer as the subject matter expert, with a chief clinical or nursing information officer, executive nurse or clinician as the accountable officer. The earlier DTAC form required the named CSO to have done NHS England's training; NHS England says that requirement no longer stands. NHS England Digital still runs digital clinical safety training for NHS organisations and manufacturers. Its guidance on AI ambient scribing puts "assign a clinical safety officer and identify key risks" as the first step.

What it does not mean

  • The CSO isn't a job title anyone can hold. The standards require a registered clinician with risk management knowledge.
  • Signing isn't the whole job. The CSO makes sure the clinical risk management process is actually followed, not only that the documents exist.
  • A supplier's CSO doesn't stand in for yours. DCB0160 needs a CSO in the deploying organisation.

Where Thalix fits

Thalix is built so that this process has somewhere to live. New agents, workflows, boards and tools ship as versioned apps with a risk tier worked out from their contents (0 views, 1 operational, 2 clinical information, 3 clinical decisions), with the reason shown. Nobody approves their own app; tier 2 also needs the clinical-safety role, which is the clinical safety officer's recorded and audited sign-off. Tier-3 apps exist only as Ed25519-signed, locked packages from a trusted publisher, and a failed upgrade puts the previous version back.

On the home page we say a pilot runs with your clinical safety officer involved from day one, and that your clinical safety team reviews each change before it goes live. In Thalix that review is a role in the system, not an email.

Thalix is at pilot stage. Demos run on synthetic data, and a hospital deployment needs its own clinical safety case, information governance approval and security review. We don't claim any certification or assessment result the product doesn't have.

Questions people ask

Does a clinical safety officer have to be a clinician?

Yes. DCB0129 and DCB0160 both say a clinical safety officer must be a suitably qualified and experienced clinician with a current registration with an appropriate professional body.

Is NHS England CSO training mandatory for DTAC?

Not any more. NHS England says the previous DTAC form required the named clinical safety officer to do NHS England's training, and that this requirement no longer stands.

What documents does a clinical safety officer approve?

The clinical risk management plan, each version of the hazard log, and each clinical safety case report.

Sources

Each source below is an official page, read and checked in October 2026. Where a page and this guide differ, the official page wins.

General information only, written for hospital digital, IT, operations and clinical safety teams. It isn't legal, regulatory, information governance or clinical safety advice, and it doesn't replace your own organisation's processes or the official guidance linked above.

Thalix Health

See Thalix on a demo hospital.

A conversation with us is 45 minutes and free: the work you want to hand to agents, the systems involved, and where Thalix would and wouldn't fit. Demos run on synthetic patients.